Extend log retention for all security and network devices to 180 days for all traffic The incident investigation was hampered because "logs were unavailable for various types of traffic," which is a direct monitoring/forensics gap. Longer and more comprehensive retention is needed so security teams can reconstruct events and spot suspicious cross-environment access.
Ensure all network and security devices are sending relevant data to the SIEM Proper monitoring requires centralized, correlated visibility; without all firewalls, routers, and other security tools feeding events to the SIEM, lateral movement from non-prod to prod can go undetected. Centralized logging from "all services and infrastructure components" is a core monitoring best practice.